TLS API refactor

src/certs.h

@@ -0,0 +1,159 @@
+#pragma once
+
+#define CA_ISRG_ROOT_X2                                                \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIICGzCCAaGgAwIBAgIQQdKd0XLq7qeAwSxs6S+HUjAKBggqhkjOPQQDAzBPMQsw\n" \
+  "CQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2gg\n" \
+  "R3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMjAeFw0yMDA5MDQwMDAwMDBaFw00\n" \
+  "MDA5MTcxNjAwMDBaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBT\n" \
+  "ZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYw\n" \
+  "EAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW\n" \
+  "+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9\n" \
+  "ItgKbppbd9/w+kHsOdx1ymgHDB/qo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0T\n" \
+  "AQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwCgYIKoZI\n" \
+  "zj0EAwMDaAAwZQIwe3lORlCEwkSHRhtFcP9Ymd70/aTSVaYgLXTWNLxBo1BfASdW\n" \
+  "tL4ndQavEi51mI38AjEAi/V3bNTIZargCyzuFJ0nN6T5U6VR5CmD1/iQMVtCnwr1\n" \
+  "/q4AaOeMSQ+2b1tbFfLn\n"                                             \
+  "-----END CERTIFICATE-----\n"
+
+#define CA_ISRG_ROOT_X1                                                \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw\n" \
+  "TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\n" \
+  "cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4\n" \
+  "WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu\n" \
+  "ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY\n" \
+  "MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc\n" \
+  "h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+\n" \
+  "0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U\n" \
+  "A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW\n" \
+  "T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH\n" \
+  "B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC\n" \
+  "B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv\n" \
+  "KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn\n" \
+  "OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn\n" \
+  "jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw\n" \
+  "qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI\n" \
+  "rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV\n" \
+  "HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq\n" \
+  "hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL\n" \
+  "ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ\n" \
+  "3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK\n" \
+  "NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5\n" \
+  "ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur\n" \
+  "TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC\n" \
+  "jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc\n" \
+  "oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq\n" \
+  "4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA\n" \
+  "mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d\n" \
+  "emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=\n" \
+  "-----END CERTIFICATE-----\n"
+
+#define CA_GOOGLE_TRUST                                                \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBxTCCAWugAwIBAgINAfD3nVndblD3QnNxUDAKBggqhkjOPQQDAjBEMQswCQYD\n" \
+  "VQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzERMA8G\n" \
+  "A1UEAxMIR1RTIExUU1IwHhcNMTgxMTAxMDAwMDQyWhcNNDIxMTAxMDAwMDQyWjBE\n" \
+  "MQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExM\n" \
+  "QzERMA8GA1UEAxMIR1RTIExUU1IwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATN\n" \
+  "8YyO2u+yCQoZdwAkUNv5c3dokfULfrA6QJgFV2XMuENtQZIG5HUOS6jFn8f0ySlV\n" \
+  "eORCxqFyjDJyRn86d+Iko0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUw\n" \
+  "AwEB/zAdBgNVHQ4EFgQUPv7/zFLrvzQ+PfNA0OQlsV+4u1IwCgYIKoZIzj0EAwID\n" \
+  "SAAwRQIhAPKuf/VtBHqGw3TUwUIq7TfaExp3bH7bjCBmVXJupT9FAiBr0SmCtsuk\n" \
+  "miGgpajjf/gFigGM34F9021bCWs1MbL0SA==\n"                             \
+  "-----END CERTIFICATE-----\n"
+
+#define CA_GLOBALSIGN_EC                                               \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIB4TCCAYegAwIBAgIRKjikHJYKBN5CsiilC+g0mAIwCgYIKoZIzj0EAwIwUDEk\n" \
+  "MCIGA1UECxMbR2xvYmFsU2lnbiBFQ0MgUm9vdCBDQSAtIFI0MRMwEQYDVQQKEwpH\n" \
+  "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTEyMTExMzAwMDAwMFoX\n" \
+  "DTM4MDExOTAzMTQwN1owUDEkMCIGA1UECxMbR2xvYmFsU2lnbiBFQ0MgUm9vdCBD\n" \
+  "QSAtIFI0MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\n" \
+  "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEuMZ5049sJQ6fLjkZHAOkrprlOQcJ\n" \
+  "FspjsbmG+IpXwVfOQvpzofdlQv8ewQCybnMO/8ch5RikqtlxP6jUuc6MHaNCMEAw\n" \
+  "DgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFFSwe61F\n" \
+  "uOJAf/sKbvu+M8k8o4TVMAoGCCqGSM49BAMCA0gAMEUCIQDckqGgE6bPA7DmxCGX\n" \
+  "kPoUVy0D7O48027KqGx2vKLeuwIgJ6iFJzWbVsaj8kfSt24bAgAXqmemFZHe+pTs\n" \
+  "ewv4n4Q=\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define CA_GLOBALSIGN_RSA                                              \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG\n" \
+  "A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv\n" \
+  "b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw\n" \
+  "MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i\n" \
+  "YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT\n" \
+  "aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ\n" \
+  "jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp\n" \
+  "xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp\n" \
+  "1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\n" \
+  "snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\n" \
+  "U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n" \
+  "9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E\n" \
+  "BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B\n" \
+  "AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz\n" \
+  "yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE\n" \
+  "38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP\n" \
+  "AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad\n" \
+  "DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME\n" \
+  "HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==\n"                             \
+  "-----END CERTIFICATE-----\n"
+
+#define CA_DIGICERT                                                    \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh\n" \
+  "MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\n" \
+  "d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD\n" \
+  "QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT\n" \
+  "MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j\n" \
+  "b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG\n" \
+  "9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB\n" \
+  "CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97\n" \
+  "nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt\n" \
+  "43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P\n" \
+  "T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4\n" \
+  "gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO\n" \
+  "BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR\n" \
+  "TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw\n" \
+  "DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr\n" \
+  "hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg\n" \
+  "06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF\n" \
+  "PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls\n" \
+  "YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk\n" \
+  "CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=\n"                 \
+  "-----END CERTIFICATE-----\n"
+
+#define CA_AMAZON_4                                                    \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIB8jCCAXigAwIBAgITBmyf18G7EEwpQ+Vxe3ssyBrBDjAKBggqhkjOPQQDAzA5\n" \
+  "MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g\n" \
+  "Um9vdCBDQSA0MB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkG\n" \
+  "A1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJvb3Qg\n" \
+  "Q0EgNDB2MBAGByqGSM49AgEGBSuBBAAiA2IABNKrijdPo1MN/sGKe0uoe0ZLY7Bi\n" \
+  "9i0b2whxIdIA6GO9mif78DluXeo9pcmBqqNbIJhFXRbb/egQbeOc4OO9X4Ri83Bk\n" \
+  "M6DLJC9wuoihKqB1+IGuYgbEgds5bimwHvouXKNCMEAwDwYDVR0TAQH/BAUwAwEB\n" \
+  "/zAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0OBBYEFNPsxzplbszh2naaVvuc84ZtV+WB\n" \
+  "MAoGCCqGSM49BAMDA2gAMGUCMDqLIfG9fhGt0O9Yli/W651+kI0rz2ZVwyzjKKlw\n" \
+  "CkcO8DdZEv8tmZQoTipPNU0zWgIxAOp1AE47xDqUEpHJWEadIRNyp4iciuRMStuW\n" \
+  "1KyLa2tJElMzrdfkviT8tQp21KW8EA==\n"                                 \
+  "-----END CERTIFICATE-----\n"
+
+#define CA_AMAZON_3                                                    \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBtjCCAVugAwIBAgITBmyf1XSXNmY/Owua2eiedgPySjAKBggqhkjOPQQDAjA5\n" \
+  "MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g\n" \
+  "Um9vdCBDQSAzMB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkG\n" \
+  "A1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJvb3Qg\n" \
+  "Q0EgMzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCmXp8ZBf8ANm+gBG1bG8lKl\n" \
+  "ui2yEujSLtf6ycXYqm0fc4E7O5hrOXwzpcVOho6AF2hiRVd9RFgdszflZwjrZt6j\n" \
+  "QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBSr\n" \
+  "ttvXBp43rDCGB5Fwx5zEGbF4wDAKBggqhkjOPQQDAgNJADBGAiEA4IWSoxe3jfkr\n" \
+  "BqWTrBqYaGFy+uGh0PsceGCmQ5nFuMQCIQCcAu/xlJyzlvnrxir4tiz+OpAUFteM\n" \
+  "YyRIHN8wfdVoOw==\n"                                                 \
+  "-----END CERTIFICATE-----\n"
+
+#define CA_ALL                                                     \
+  CA_ISRG_ROOT_X1 CA_ISRG_ROOT_X2 CA_GOOGLE_TRUST CA_GLOBALSIGN_EC \
+      CA_GLOBALSIGN_RSA CA_DIGICERT CA_AMAZON_4 CA_AMAZON_3

src/config.h

@@ -36,18 +36,6 @@
 #define MG_ENABLE_FATFS 0
 #endif
 
-#ifndef MG_ENABLE_MBEDTLS
-#define MG_ENABLE_MBEDTLS 0
-#endif
-
-#ifndef MG_ENABLE_OPENSSL
-#define MG_ENABLE_OPENSSL 0
-#endif
-
-#ifndef MG_ENABLE_CUSTOM_TLS
-#define MG_ENABLE_CUSTOM_TLS 0
-#endif
-
 #ifndef MG_ENABLE_SSI
 #define MG_ENABLE_SSI 0
 #endif

src/net.c

@@ -164,6 +164,10 @@ struct mg_connection *mg_connect(struct mg_mgr *mgr, const char *url,
     MG_DEBUG(("%lu %p %s", c->id, c->fd, url));
     mg_call(c, MG_EV_OPEN, NULL);
     mg_resolve(c, url);
+    if (mg_url_is_ssl(url)) {
+      struct mg_str host = mg_url_host(url);
+      mg_tls_init(c, host);
+    }
   }
   return c;
 }
@@ -184,6 +188,7 @@ struct mg_connection *mg_listen(struct mg_mgr *mgr, const char *url,
     c->fn = fn;
     c->fn_data = fn_data;
     mg_call(c, MG_EV_OPEN, NULL);
+    if (mg_url_is_ssl(url)) c->is_tls = 1; // Accepted connection must
     MG_DEBUG(("%lu %p %s", c->id, c->fd, url));
   }
   return c;
@@ -227,6 +232,7 @@ void mg_mgr_free(struct mg_mgr *mgr) {
 #if MG_ENABLE_EPOLL
   if (mgr->epoll_fd >= 0) close(mgr->epoll_fd), mgr->epoll_fd = -1;
 #endif
+  mg_tls_ctx_free(mgr);
 }
 
 void mg_mgr_init(struct mg_mgr *mgr) {

src/sock.c

@@ -414,6 +414,7 @@ static void accept_conn(struct mg_mgr *mgr, struct mg_connection *lsn) {
               &c->rem, mg_print_ip_port, &c->loc));
     mg_call(c, MG_EV_OPEN, NULL);
     mg_call(c, MG_EV_ACCEPT, NULL);
+    if (lsn->is_tls) mg_tls_init(c, mg_str(""));
   }
 }
 

src/tcpip/tcpip.c

@@ -525,6 +525,7 @@ static struct mg_connection *accept_conn(struct mg_connection *lsn,
   c->fn_data = lsn->fn_data;
   mg_call(c, MG_EV_OPEN, NULL);
   mg_call(c, MG_EV_ACCEPT, NULL);
+  if (lsn->is_tls) mg_tls_init(c, mg_str(""));
   return c;
 }
 

src/tls.h

@@ -1,20 +1,31 @@
 #pragma once
 
+#define MG_TLS_NONE 0     // No TLS support
+#define MG_TLS_MBED 1     // mbedTLS
+#define MG_TLS_OPENSSL 2  // OpenSSL
+#define MG_TLS_BUILTIN 3  // Built-in
+#define MG_TLS_CUSTOM 4   // Custom implementation
+
+#ifndef MG_TLS
+#define MG_TLS MG_TLS_NONE
+#endif
+
 #include "net.h"
 #include "tls_mbed.h"
 #include "tls_openssl.h"
 
 struct mg_tls_opts {
-  const char *ca;         // CA certificate file. For both listeners and clients
-  const char *crl;        // Certificate Revocation List. For clients
-  const char *cert;       // Certificate
-  const char *certkey;    // Certificate key
-  const char *ciphers;    // Cipher list
-  struct mg_str srvname;  // If not empty, enables server name verification
-  struct mg_fs *fs;       // FS API for reading certificate files
+  struct mg_str client_ca;
+  struct mg_str server_ca;
+  struct mg_str server_cert;
+  struct mg_str server_key;
+  struct mg_str client_cert;
+  struct mg_str client_key;
 };
 
-void mg_tls_init(struct mg_connection *, const struct mg_tls_opts *);
+void mg_tls_ctx_init(struct mg_mgr *, const struct mg_tls_opts *);
+void mg_tls_ctx_free(struct mg_mgr *);
+void mg_tls_init(struct mg_connection *, struct mg_str hostname);
 void mg_tls_free(struct mg_connection *);
 long mg_tls_send(struct mg_connection *, const void *buf, size_t len);
 long mg_tls_recv(struct mg_connection *, void *buf, size_t len);

src/tls_dummy.c

@@ -1,8 +1,8 @@
 #include "tls.h"
 
-#if !MG_ENABLE_MBEDTLS && !MG_ENABLE_OPENSSL && !MG_ENABLE_CUSTOM_TLS
-void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
-  (void) opts;
+#if MG_TLS == MG_TLS_NONE
+void mg_tls_init(struct mg_connection *c, struct mg_str hostname) {
+  (void) hostname;
   mg_error(c, "TLS is not enabled");
 }
 void mg_tls_handshake(struct mg_connection *c) {
@@ -21,4 +21,10 @@ size_t mg_tls_pending(struct mg_connection *c) {
   (void) c;
   return 0;
 }
+void mg_tls_ctx_free(struct mg_mgr *mgr) {
+  mgr->tls_ctx = NULL;
+}
+void mg_tls_ctx_init(struct mg_mgr *mgr, const struct mg_tls_opts *opts) {
+  (void) opts, (void) mgr;
+}
 #endif

src/tls_mbed.c

@@ -2,7 +2,7 @@
 #include "printf.h"
 #include "tls.h"
 
-#if MG_ENABLE_MBEDTLS
+#if MG_TLS == MG_TLS_MBED
 
 #if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000
 #define MGRNG , rng_get, NULL
@@ -13,11 +13,7 @@
 void mg_tls_free(struct mg_connection *c) {
   struct mg_tls *tls = (struct mg_tls *) c->tls;
   if (tls != NULL) {
-    free(tls->cafile);
     mbedtls_ssl_free(&tls->ssl);
-    mbedtls_pk_free(&tls->pk);
-    mbedtls_x509_crt_free(&tls->ca);
-    mbedtls_x509_crt_free(&tls->cert);
     mbedtls_ssl_config_free(&tls->conf);
     free(tls);
     c->tls = NULL;
@@ -70,7 +66,7 @@ static void debug_cb(void *c, int lev, const char *s, int n, const char *s2) {
   (void) s;
 }
 
-#if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
 static int rng_get(void *p_rng, unsigned char *buf, size_t len) {
   (void) p_rng;
   mg_random(buf, len);
@@ -78,28 +74,20 @@ static int rng_get(void *p_rng, unsigned char *buf, size_t len) {
 }
 #endif
 
-static struct mg_str mg_loadfile(struct mg_fs *fs, const char *path) {
-  size_t n = 0;
-  if (path[0] == '-') return mg_str(path);
-  char *p = mg_file_read(fs, path, &n);
-  return mg_str_n(p, n);
-}
-
-void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
-  struct mg_fs *fs = opts->fs == NULL ? &mg_fs_posix : opts->fs;
+void mg_tls_init(struct mg_connection *c, struct mg_str hostname) {
+  struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) c->mgr->tls_ctx;
   struct mg_tls *tls = (struct mg_tls *) calloc(1, sizeof(*tls));
   int rc = 0;
+
   c->tls = tls;
   if (c->tls == NULL) {
     mg_error(c, "TLS OOM");
     goto fail;
   }
+
   MG_DEBUG(("%lu Setting TLS", c->id));
   mbedtls_ssl_init(&tls->ssl);
   mbedtls_ssl_config_init(&tls->conf);
-  mbedtls_x509_crt_init(&tls->ca);
-  mbedtls_x509_crt_init(&tls->cert);
-  mbedtls_pk_init(&tls->pk);
   mbedtls_ssl_conf_dbg(&tls->conf, debug_cb, c);
 #if defined(MG_MBEDTLS_DEBUG_LEVEL)
   mbedtls_debug_set_threshold(MG_MBEDTLS_DEBUG_LEVEL);
@@ -112,60 +100,47 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
     goto fail;
   }
   mbedtls_ssl_conf_rng(&tls->conf, mbed_rng, c);
-  if (opts->ca == NULL || strcmp(opts->ca, "*") == 0) {
-    mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_NONE);
-  } else if (opts->ca != NULL && opts->ca[0] != '\0') {
-#if defined(MBEDTLS_X509_CA_CHAIN_ON_DISK)
-    tls->cafile = strdup(opts->ca);
-    rc = mbedtls_ssl_conf_ca_chain_file(&tls->conf, tls->cafile, NULL);
-    if (rc != 0) {
-      mg_error(c, "parse on-disk chain(%s) err %#x", tls->cafile, -rc);
-      goto fail;
-    }
-#else
-    struct mg_str s = mg_loadfile(fs, opts->ca);
-    rc = mbedtls_x509_crt_parse(&tls->ca, (uint8_t *) s.ptr, s.len + 1);
-    if (opts->ca[0] != '-') free((char *) s.ptr);
-    if (rc != 0) {
-      mg_error(c, "parse(%s) err %#x", opts->ca, -rc);
-      goto fail;
-    }
-    mbedtls_ssl_conf_ca_chain(&tls->conf, &tls->ca, NULL);
-#endif
-    if (opts->srvname.len > 0) {
-      char *x = mg_mprintf("%.*s", (int) opts->srvname.len, opts->srvname.ptr);
-      mbedtls_ssl_set_hostname(&tls->ssl, x);
-      free(x);
-    }
+
+  if (c->is_client && ctx->client_ca.version) {
+    mbedtls_ssl_conf_ca_chain(&tls->conf, &ctx->client_ca, NULL);
     mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_REQUIRED);
+    if (hostname.ptr != NULL && hostname.ptr[0] != '\0') {
+      struct mg_addr addr;
+      if (!mg_aton(hostname, &addr)) {  // if srvname is not an IP address
+        char *host = mg_mprintf("%.*s", (int) hostname.len, hostname.ptr);
+        mbedtls_ssl_set_hostname(&tls->ssl, host);
+        free(host);
+      }
+    }
+  } else if (!c->is_client && ctx->server_ca.version) {
+    mbedtls_ssl_conf_ca_chain(&tls->conf, &ctx->server_ca, NULL);
+    mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_REQUIRED);
+  } else {
+    mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_NONE);
   }
-  if (opts->cert != NULL && opts->cert[0] != '\0') {
-    struct mg_str s = mg_loadfile(fs, opts->cert);
-    const char *key = opts->certkey == NULL ? opts->cert : opts->certkey;
-    rc = mbedtls_x509_crt_parse(&tls->cert, (uint8_t *) s.ptr, s.len + 1);
-    if (opts->cert[0] != '-') free((char *) s.ptr);
-    if (rc != 0) {
-      mg_error(c, "parse(%s) err %#x", opts->cert, -rc);
-      goto fail;
-    }
-    s = mg_loadfile(fs, key);
-    rc = mbedtls_pk_parse_key(&tls->pk, (uint8_t *) s.ptr, s.len + 1, NULL,
-                              0 MGRNG);
-    if (key[0] != '-') free((char *) s.ptr);
-    if (rc != 0) {
-      mg_error(c, "tls key(%s) %#x", key, -rc);
-      goto fail;
-    }
-    rc = mbedtls_ssl_conf_own_cert(&tls->conf, &tls->cert, &tls->pk);
-    if (rc != 0) {
-      mg_error(c, "own cert %#x", -rc);
-      goto fail;
-    }
+  if (c->is_client && ctx->client_cert.version &&
+      (rc = mbedtls_ssl_conf_own_cert(&tls->conf, &ctx->client_cert,
+                                      &ctx->client_key)) != 0) {
+    mg_error(c, "own cert %#x", -rc);
+    goto fail;
   }
+  if (!c->is_client && ctx->server_cert.version &&
+      (rc = mbedtls_ssl_conf_own_cert(&tls->conf, &ctx->server_cert,
+                                      &ctx->server_key)) != 0) {
+    mg_error(c, "own cert %#x", -rc);
+    goto fail;
+  }
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
+  mbedtls_ssl_conf_session_tickets_cb(&tls->conf, mbedtls_ssl_ticket_write,
+                                      mbedtls_ssl_ticket_parse,
+                                      &ctx->ticket_ctx);
+#endif
+
   if ((rc = mbedtls_ssl_setup(&tls->ssl, &tls->conf)) != 0) {
     mg_error(c, "setup err %#x", -rc);
     goto fail;
   }
+
   c->tls = tls;
   c->is_tls = 1;
   c->is_tls_hs = 1;
@@ -200,4 +175,77 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
   if (n <= 0) return MG_IO_ERR;
   return n;
 }
+
+static bool load_cert(struct mg_str str, mbedtls_x509_crt *p) {
+  int rc;
+  if (str.ptr == NULL || str.ptr[0] == '\0' || str.ptr[0] == '*') return true;
+  if (str.ptr[0] == '-') str.len++;  // PEM, include trailing NUL
+  if ((rc = mbedtls_x509_crt_parse(p, (uint8_t *) str.ptr, str.len)) != 0) {
+    MG_ERROR(("cert err %#x", -rc));
+    return false;
+  }
+  return true;
+}
+
+static bool load_key(struct mg_str str, mbedtls_pk_context *p) {
+  int rc;
+  if (str.ptr == NULL || str.ptr[0] == '\0' || str.ptr[0] == '*') return true;
+  if (str.ptr[0] == '-') str.len++;  // PEM, include trailing NUL
+  if ((rc = mbedtls_pk_parse_key(p, (uint8_t *) str.ptr, str.len, NULL,
+                                 0 MGRNG)) != 0) {
+    MG_ERROR(("key err %#x", -rc));
+    return false;
+  }
+  return true;
+}
+
+void mg_tls_ctx_init(struct mg_mgr *mgr, const struct mg_tls_opts *opts) {
+  struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) calloc(1, sizeof(*ctx));
+  if (ctx == NULL) goto fail;
+  MG_DEBUG(("Setting up TLS context"));
+
+#if defined(MG_MBEDTLS_DEBUG_LEVEL)
+  mbedtls_debug_set_threshold(MG_MBEDTLS_DEBUG_LEVEL);
+#endif
+
+  if (!load_cert(opts->client_ca, &ctx->client_ca)) goto fail;
+  if (!load_cert(opts->server_ca, &ctx->server_ca)) goto fail;
+  if (!load_cert(opts->client_cert, &ctx->client_cert)) goto fail;
+  if (!load_cert(opts->server_cert, &ctx->server_cert)) goto fail;
+  if (!load_key(opts->server_key, &ctx->server_key)) goto fail;
+  if (!load_key(opts->client_key, &ctx->client_key)) goto fail;
+
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
+  {
+    int rc;
+    mbedtls_ssl_ticket_init(&ctx->ticket_ctx);
+    if ((rc = mbedtls_ssl_ticket_setup(&ctx->ticket_ctx, rng_get, NULL,
+                                       MBEDTLS_CIPHER_AES_128_GCM, 86400)) !=
+        0) {
+      MG_ERROR(("setup session tickets err %#x", -rc));
+      goto fail;
+    }
+  }
+#endif
+  mgr->tls_ctx = ctx;
+  return;
+fail:
+  mg_tls_ctx_free(mgr);
+}
+
+void mg_tls_ctx_free(struct mg_mgr *mgr) {
+  struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) mgr->tls_ctx;
+  if (ctx != NULL) {
+    mbedtls_x509_crt_free(&ctx->server_cert);
+    mbedtls_pk_free(&ctx->server_key);
+    mbedtls_x509_crt_free(&ctx->client_cert);
+    mbedtls_pk_free(&ctx->client_key);
+    mbedtls_x509_crt_free(&ctx->client_ca);
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
+    mbedtls_ssl_ticket_free(&ctx->ticket_ctx);
+#endif
+    free(ctx);
+    mgr->tls_ctx = NULL;
+  }
+}
 #endif

src/tls_mbed.h

@@ -5,17 +5,26 @@
 #include "url.h"
 #include "util.h"
 
-#if MG_ENABLE_MBEDTLS
+#if MG_TLS == MG_TLS_MBED
 #include <mbedtls/debug.h>
 #include <mbedtls/net_sockets.h>
 #include <mbedtls/ssl.h>
+#include <mbedtls/ssl_ticket.h>
+
+struct mg_tls_ctx {
+  mbedtls_x509_crt server_ca;     // Parsed CA certificate
+  mbedtls_x509_crt client_ca;     // Parsed CA certificate
+  mbedtls_x509_crt server_cert;   // Parsed server certificate
+  mbedtls_pk_context server_key;  // Parsed server private key context
+  mbedtls_x509_crt client_cert;   // Parsed client certificate
+  mbedtls_pk_context client_key;  // Parsed client private key context
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
+  mbedtls_ssl_ticket_context ticket_ctx;  // Session tickets context
+#endif
+};
 
 struct mg_tls {
-  char *cafile;             // CA certificate path
-  mbedtls_x509_crt ca;      // Parsed CA certificate
-  mbedtls_x509_crt cert;    // Parsed certificate
   mbedtls_ssl_context ssl;  // SSL/TLS context
   mbedtls_ssl_config conf;  // SSL-TLS config
-  mbedtls_pk_context pk;    // Private key context
 };
 #endif

src/tls_openssl.c

@@ -1,7 +1,7 @@
 #include "printf.h"
 #include "tls.h"
 
-#if MG_ENABLE_OPENSSL
+#if MG_TLS == MG_TLS_OPENSSL
 static int mg_tls_err(struct mg_tls *tls, int res) {
   int err = SSL_get_error(tls->ssl, res);
   // We've just fetched the last error from the queue.
@@ -20,38 +20,63 @@ static int mg_tls_err(struct mg_tls *tls, int res) {
   return err;
 }
 
-void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
+static STACK_OF(X509_INFO) * load_ca_certs(const char *ca, int ca_len) {
+  BIO *ca_bio = BIO_new_mem_buf(ca, ca_len);
+  if (!ca_bio) return NULL;
+  STACK_OF(X509_INFO) *certs = PEM_X509_INFO_read_bio(ca_bio, NULL, NULL, NULL);
+  BIO_free(ca_bio);
+  return certs;
+}
+
+static bool add_ca_certs(SSL_CTX *ctx, STACK_OF(X509_INFO) * certs) {
+  X509_STORE *cert_store = SSL_CTX_get_cert_store(ctx);
+  for (int i = 0; i < sk_X509_INFO_num(certs); i++) {
+    X509_INFO *cert_info = sk_X509_INFO_value(certs, i);
+    if (cert_info->x509 && !X509_STORE_add_cert(cert_store, cert_info->x509))
+      return false;
+  }
+  return true;
+}
+
+static EVP_PKEY *load_key(const char *key, int key_len) {
+  BIO *key_bio = BIO_new_mem_buf(key, key_len);
+  if (!key_bio) return NULL;
+  EVP_PKEY *priv_key = PEM_read_bio_PrivateKey(key_bio, NULL, 0, NULL);
+  BIO_free(key_bio);
+  return priv_key;
+}
+
+static X509 *load_cert(const char *cert, int cert_len) {
+  BIO *cert_bio = BIO_new_mem_buf(cert, cert_len);
+  if (!cert_bio) return NULL;
+  X509 *x509 = PEM_read_bio_X509(cert_bio, NULL, 0, NULL);
+  BIO_free(cert_bio);
+  return x509;
+}
+
+void mg_tls_init(struct mg_connection *c, struct mg_str hostname) {
+  struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) c->mgr->tls_ctx;
   struct mg_tls *tls = (struct mg_tls *) calloc(1, sizeof(*tls));
-  const char *id = "mongoose";
-  static unsigned char s_initialised = 0;
-  int rc;
+
+  if (ctx == NULL) {
+    mg_error(c, "TLS context not initialized");
+    goto fail;
+  }
 
   if (tls == NULL) {
     mg_error(c, "TLS OOM");
     goto fail;
   }
 
-  if (!s_initialised) {
-    SSL_library_init();
-    s_initialised++;
-  }
-  MG_DEBUG(("%lu Setting TLS, CA: %s, cert: %s, key: %s", c->id,
-            opts->ca == NULL ? "null" : opts->ca,
-            opts->cert == NULL ? "null" : opts->cert,
-            opts->certkey == NULL ? "null" : opts->certkey));
-  tls->ctx = c->is_client ? SSL_CTX_new(SSLv23_client_method())
-                          : SSL_CTX_new(SSLv23_server_method());
+  tls->ctx = c->is_client ? SSL_CTX_new(TLS_client_method())
+                          : SSL_CTX_new(TLS_server_method());
   if ((tls->ssl = SSL_new(tls->ctx)) == NULL) {
     mg_error(c, "SSL_new");
     goto fail;
   }
-  SSL_set_session_id_context(tls->ssl, (const uint8_t *) id,
-                             (unsigned) strlen(id));
-  // Disable deprecated protocols
-  SSL_set_options(tls->ssl, SSL_OP_NO_SSLv2);
-  SSL_set_options(tls->ssl, SSL_OP_NO_SSLv3);
-  SSL_set_options(tls->ssl, SSL_OP_NO_TLSv1);
-  SSL_set_options(tls->ssl, SSL_OP_NO_TLSv1_1);
+
+  SSL_set_min_proto_version(tls->ssl, TLS1_2_VERSION);
+
 #ifdef MG_ENABLE_OPENSSL_NO_COMPRESSION
   SSL_set_options(tls->ssl, SSL_OP_NO_COMPRESSION);
 #endif
@@ -59,45 +84,54 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
   SSL_set_options(tls->ssl, SSL_OP_CIPHER_SERVER_PREFERENCE);
 #endif
 
-  if (opts->ca != NULL && opts->ca[0] != '\0') {
-    SSL_set_verify(tls->ssl, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
-                   NULL);
-    if ((rc = SSL_CTX_load_verify_locations(tls->ctx, opts->ca, NULL)) != 1) {
-      mg_error(c, "load('%s') %d err %d", opts->ca, rc, mg_tls_err(tls, rc));
-      goto fail;
+  if (c->is_client) {
+    if (ctx->client_ca) {
+      SSL_set_verify(tls->ssl,
+                     SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);
+      if (!add_ca_certs(tls->ctx, ctx->client_ca)) goto fail;
+    }
+    if (ctx->client_cert && ctx->client_key) {
+      if (SSL_use_certificate(tls->ssl, ctx->client_cert) != 1) {
+        mg_error(c, "SSL_CTX_use_certificate");
+        goto fail;
+      }
+      if (SSL_use_PrivateKey(tls->ssl, ctx->client_key) != 1) {
+        mg_error(c, "SSL_CTX_use_PrivateKey");
+        goto fail;
+      }
+    }
+  } else {
+    if (ctx->server_ca) {
+      SSL_set_verify(tls->ssl,
+                     SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);
+      if (!add_ca_certs(tls->ctx, ctx->server_ca)) goto fail;
+    }
+    if (ctx->server_cert && ctx->server_key) {
+      if (SSL_use_certificate(tls->ssl, ctx->server_cert) != 1) {
+        mg_error(c, "SSL_CTX_use_certificate");
+        goto fail;
+      }
+      if (SSL_use_PrivateKey(tls->ssl, ctx->server_key) != 1) {
+        mg_error(c, "SSL_CTX_use_PrivateKey");
+        goto fail;
+      }
     }
   }
-  if (opts->cert != NULL && opts->cert[0] != '\0') {
-    const char *key = opts->certkey;
-    if (key == NULL) key = opts->cert;
-    if ((rc = SSL_use_certificate_file(tls->ssl, opts->cert, 1)) != 1) {
-      mg_error(c, "Invalid SSL cert, err %d", mg_tls_err(tls, rc));
-      goto fail;
-    } else if ((rc = SSL_use_PrivateKey_file(tls->ssl, key, 1)) != 1) {
-      mg_error(c, "Invalid SSL key, err %d", mg_tls_err(tls, rc));
-      goto fail;
-#if OPENSSL_VERSION_NUMBER > 0x10100000L
-    } else if ((rc = SSL_use_certificate_chain_file(tls->ssl, opts->cert)) !=
-               1) {
-      mg_error(c, "Invalid chain, err %d", mg_tls_err(tls, rc));
-      goto fail;
-#endif
-    } else {
-      SSL_set_mode(tls->ssl, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
+
+  SSL_set_mode(tls->ssl, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 #if OPENSSL_VERSION_NUMBER > 0x10002000L
-      SSL_set_ecdh_auto(tls->ssl, 1);
+  SSL_set_ecdh_auto(tls->ssl, 1);
 #endif
-    }
-  }
-  if (opts->ciphers != NULL) SSL_set_cipher_list(tls->ssl, opts->ciphers);
+
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
-  if (opts->srvname.len > 0) {
-    char *s = mg_mprintf("%.*s", (int) opts->srvname.len, opts->srvname.ptr);
+  if (c->is_client && hostname.ptr && hostname.ptr[0] != '\0') {
+    char *s = mg_mprintf("%.*s", (int) hostname.len, hostname.ptr);
     SSL_set1_host(tls->ssl, s);
     SSL_set_tlsext_host_name(tls->ssl, s);
     free(s);
   }
 #endif
+
   c->tls = tls;
   c->is_tls = 1;
   c->is_tls_hs = 1;
@@ -106,6 +140,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
   }
   MG_DEBUG(("%lu SSL %s OK", c->id, c->is_accepted ? "accept" : "client"));
   return;
+
 fail:
   c->is_closing = 1;
   free(tls);
@@ -155,4 +190,68 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
   if (n <= 0) return MG_IO_ERR;
   return n;
 }
+
+void mg_tls_ctx_free(struct mg_mgr *mgr) {
+  struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) mgr->tls_ctx;
+  if (ctx) {
+    if (ctx->server_cert) X509_free(ctx->server_cert);
+    if (ctx->server_key) EVP_PKEY_free(ctx->server_key);
+    if (ctx->server_ca)
+      sk_X509_INFO_pop_free(ctx->server_ca, X509_INFO_free);
+    if (ctx->client_cert) X509_free(ctx->client_cert);
+    if (ctx->client_key) EVP_PKEY_free(ctx->client_key);
+    if (ctx->client_ca)
+      sk_X509_INFO_pop_free(ctx->client_ca, X509_INFO_free);
+    free(ctx);
+    mgr->tls_ctx = NULL;
+  }
+}
+
+void mg_tls_ctx_init(struct mg_mgr *mgr, const struct mg_tls_opts *opts) {
+  static unsigned char s_initialised = 0;
+  if (!s_initialised) {
+    SSL_library_init();
+    s_initialised++;
+  }
+
+  struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) calloc(1, sizeof(*ctx));
+  if (ctx == NULL) return;
+
+  if (opts->server_cert.ptr && opts->server_cert.ptr[0] != '\0') {
+    struct mg_str key = opts->server_key;
+    if (!key.ptr) key = opts->server_cert;
+    if (!(ctx->server_cert =
+              load_cert(opts->server_cert.ptr, (int) opts->server_cert.len)))
+      goto fail;
+    if (!(ctx->server_key = load_key(key.ptr, (int) key.len))) goto fail;
+  }
+
+  if (opts->server_ca.ptr && opts->server_ca.ptr[0] != '\0') {
+    if (!(ctx->server_ca =
+              load_ca_certs(opts->server_ca.ptr, (int) opts->server_ca.len)))
+      goto fail;
+  }
+
+  if (opts->client_cert.ptr && opts->client_cert.ptr[0] != '\0') {
+    struct mg_str key = opts->client_key;
+    if (!key.ptr) key = opts->client_cert;
+    if (!(ctx->client_cert =
+              load_cert(opts->client_cert.ptr, (int) opts->client_cert.len)))
+      goto fail;
+    if (!(ctx->client_key = load_key(key.ptr, (int) key.len))) goto fail;
+  }
+
+  if (opts->client_ca.ptr && opts->client_ca.ptr[0] != '\0') {
+    if (!(ctx->client_ca =
+              load_ca_certs(opts->client_ca.ptr, (int) opts->client_ca.len)))
+      goto fail;
+  }
+
+  mgr->tls_ctx = ctx;
+  return;
+fail:
+  MG_ERROR(("TLS ctx init error"));
+  mg_tls_ctx_free(mgr);
+}
+
 #endif

src/tls_openssl.h

@@ -1,10 +1,19 @@
 #pragma once
 
-#if MG_ENABLE_OPENSSL
+#if MG_TLS == MG_TLS_OPENSSL
 
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 
+struct mg_tls_ctx {
+  X509 *server_cert;
+  EVP_PKEY *server_key;
+  STACK_OF(X509_INFO) *server_ca;
+  X509 *client_cert;
+  EVP_PKEY *client_key;
+  STACK_OF(X509_INFO) *client_ca;
+};
+
 struct mg_tls {
   SSL_CTX *ctx;
   SSL *ssl;